njrat | 4a4dcb3d44b25875a661b16ee7d351a057b43921277b1f44a6b17354bb6936a3 | Triage

Sharing

General

Target

4a4dcb3d44b25875a661b16ee7d351a057b43921277b1f44a6b17354bb6936a3.exe
Size

89KB
Sample

240927-yctnpsyblc
MD5

343079476b1636d4c4e56249f83f9187
SHA1

d24fdb34ba242b7116f6a3e81501e99090f15c70
SHA256

4a4dcb3d44b25875a661b16ee7d351a057b43921277b1f44a6b17354bb6936a3
SHA512

ac5eb843ed6b06d1819d0d495ea2faeafda1456078c91b16f24aecc3f72718ebbf47687aaeabf1f7ef10b1a6b47a190e35b29d9bbe49d926ea1a3d2af09034c0
SSDEEP

384:tsqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZBiS+8tj9:Wf65K2Yf1jKRpcnuXdEgTK

Score

10^/10

njrat low3n discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Low3n

C2

192.168.42.7:443

Mutex

1b08a9557635966a4afb29577a39bcd4

Attributes

reg_key
1b08a9557635966a4afb29577a39bcd4
splitter
|'|'|

Targets

- Target
  
  4a4dcb3d44b25875a661b16ee7d351a057b43921277b1f44a6b17354bb6936a3.exe
- Size
  
  89KB
- MD5
  
  343079476b1636d4c4e56249f83f9187
- SHA1
  
  d24fdb34ba242b7116f6a3e81501e99090f15c70
- SHA256
  
  4a4dcb3d44b25875a661b16ee7d351a057b43921277b1f44a6b17354bb6936a3
- SHA512
  
  ac5eb843ed6b06d1819d0d495ea2faeafda1456078c91b16f24aecc3f72718ebbf47687aaeabf1f7ef10b1a6b47a190e35b29d9bbe49d926ea1a3d2af09034c0
- SSDEEP
  
  384:tsqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZBiS+8tj9:Wf65K2Yf1jKRpcnuXdEgTK
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan